EUVD-2026-116589

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted periodid parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN clauses to extract administrator...

CVE-2026-121731

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted periodid parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN clauses to extract administrator...

CVE-2026-121731

RosarioSIS versions prior to 12.9 are vulnerable to a SQL injection flaw within the StudentSummary.php component. The root cause is the use of an unquoted period_id parameter, which allows authenticated non-student users, such as parents, to inject payloads into IN() clauses. This vulnerability c...